GNU Simple Authentication and Security Layer 0.2.12

Simon Josefsson Datakonsult
Hagagatan 24
113 47 Stockholm
Sweden

E-mail: simon@josefsson.org

     $ wget -q http://josefsson.org/gsasl/releases/gsasl-0.2.12.tar.gz
     $ tar xfz gsasl-0.2.12.tar.gz
     $ cd gsasl-0.2.12/
     $ ./configure
     ...
     $ make
     ...
     $ make install
     ...

     #include <gsasl.h>

     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     ...
       rc = gsasl_init (&ctx);
       if (rc != GSASL_OK)
         {
           printf ("SASL initialization failure (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return 1;
         }
     ...

     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     ...
       setlocale (LC_ALL, "");
     ...
       rc = gsasl_init (&ctx);
       if (rc != GSASL_OK)
         {
           printf (gettext ("SASL initialization failure (%d): %s\n"),
                   rc, gsasl_strerror (rc));
           return 1;
         }
     ...

     #include <gcrypt.h>
     ...
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     ...
       /* Check version of libgcrypt. */
       if (!gcry_check_version (GCRYPT_VERSION))
         die ("version mismatch\n");
     
       /* Allocate a pool of 16k secure memory.  This also drops priviliges
          on some systems. */
       gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
     
       /* Tell Libgcrypt that initialization has completed. */
       gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
     ...
       rc = gsasl_init (&ctx);
       if (rc != GSASL_OK)
         {
           printf ("SASL initialization failure (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return 1;
         }
     ...

       if (!gsasl_check_version (GSASL_VERSION))
         {
           printf ("gsasl_check_version failed:\n"
                   "Header file incompatible with shared library.\n");
           exit(1);
         }

     gcc -c foo.c `pkg-config libgsasl --cflags`

     gcc -o foo foo.o `pkg-config libgsasl --libs`

     gcc -o foo foo.c `pkg-config libgsasl --cflags --libs`

     AC_ARG_ENABLE(gsasl,
     	AC_HELP_STRING([--disable-gsasl], [don't use GNU SASL]),
     	gsasl=$enableval)
     if test "$gsal" != "no" ; then
     	PKG_CHECK_MODULES(GSASL, libgsasl >= 0.2.12,
     			[gsasl=yes],
                             [gsasl=no])
     	if test "$gsasl" != "yes" ; then
     		sal=no
     		AC_MSG_WARN([Cannot find GNU SASL, disabling])
     	else
     		gsasl=yes
     		AC_DEFINE(USE_GSASL, 1, [Define to 1 if you want GNU SASL.])
     	fi
     fi
     AC_MSG_CHECKING([if GNU SASL should be used])
     AC_MSG_RESULT($gsasl)

     AC_CHECK_HEADER(gsasl.h,
     	AC_CHECK_LIB(gsasl, gsasl_check_version,
     		[gsasl=yes AC_SUBST(GSASL_LIBS, -lgsasl)],
     		gsasl=no),
     	gsasl=no)
     AC_ARG_ENABLE(gsasl,
     	AC_HELP_STRING([--disable-gsasl], [don't use GNU SASL]),
     	gsasl=$enableval)
     if test "$gsasl" != "no" ; then
     	AC_DEFINE(USE_SASL, 1, [Define to 1 if you want GNU SASL.])
     else
     	AC_MSG_WARN([Cannot find GNU SASL, diabling])
     fi
     AC_MSG_CHECKING([if GNU SASL should be used])
     AC_MSG_RESULT($gsasl)

     int main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s",
                   rc, gsasl_strerror (rc));
           return 1;
         }
     
       client (ctx);
     
       gsasl_done (ctx);
     
       return 0;
     }

     void client (Gsasl *ctx)
     {
       Gsasl_session *session;
       const char *mech = "PLAIN";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }

     void client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data
          first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
             buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
             {
               printf ("Output:\n%s\n", p);
               free (p);
             }
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the
          server let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }

     const char *client_mechanism (Gsasl *ctx)
     {
       static char mech[GSASL_MAX_MECHANISM_SIZE + 1] = "";
       char mechlist[BUFSIZ] = "";
       const char *suggestion;
     
       printf ("Enter list of mechanism that server support, separate by SPC:\n");
       fgets (mechlist, sizeof (mechlist) - 1, stdin);
     
       suggestion = gsasl_client_suggest_mechanism (ctx, mechlist);
       if (suggestion)
         printf ("Library suggest use of `%s'.\n", suggestion);
     
       printf ("Enter mechanism to use:\n");
       fgets (mech, sizeof (mech) - 1, stdin);
       mech[strlen (mech) - 1] = '\0';
     
       return mech;
     }

     Enter list of mechanism that server support, separate by SPC:
     CRAM-MD5 DIGEST-MD5 GSSAPI FOO BAR
     Library suggest use of `GSSAPI'.
     Enter mechanism to use:
     CRAM-MD5
     Input base64 encoded data from server:
     Zm5vcmQ=
     Output:
     amFzIDkyY2U1NWE5MTM2ZTY4NzEyMTUyZTFjYmFmNjVkZjgx
     
     If server accepted us, we're done.

       gsasl_property_set (ctx, GSASL_AUTHID, "jas");
       gsasl_property_set (ctx, GSASL_PASSWORD, "secret");

       /* Set the callback handler for the library. */
       gsasl_callback_set (ctx, callback);

     int callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop)
     {
       char buf[BUFSIZ] = "";
       int rc = GSASL_NO_CALLBACK;
     
       /* Get user info from user. */
     
       printf ("Callback invoked, for property %d.\n", prop);
     
       switch (prop)
         {
         case GSASL_PASSCODE:
           printf ("Enter passcode:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_PASSCODE, buf);
           rc = GSASL_OK;
           break;
     
         case GSASL_AUTHID:
           printf ("Enter username:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_AUTHID, buf);
           rc = GSASL_OK;
           break;
     
         default:
           printf ("Unknown property!  Don't worry.\n");
           break;
         }
     
       return rc;
     }

     /* client.c --- Example SASL client.
      * Copyright (C) 2004, 2005  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * GNU SASL is free software; you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation; either version 2 of the License, or
      * (at your option) any later version.
      *
      * GNU SASL is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with GNU SASL; if not, write to the Free Software
      * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the client send data first. */
     
       do
         {
           /* Generate client output. */
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  /* If sucessful, print it. */
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
     
           if (rc == GSASL_NEEDS_MORE)
     	{
     	  /* If the client need more data from server, get it here. */
     	  printf ("Input base64 encoded data from server:\n");
     	  fgets (buf, sizeof (buf) - 1, stdin);
     	  if (buf[strlen (buf) - 1] == '\n')
     	    buf[strlen (buf) - 1] = '\0';
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech = "PLAIN";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

     /* client-serverfirst.c --- Example SASL client, where server send data first.
      * Copyright (C) 2004, 2005  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * GNU SASL is free software; you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation; either version 2 of the License, or
      * (at your option) any later version.
      *
      * GNU SASL is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with GNU SASL; if not, write to the Free Software
      * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
     	buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech = "CRAM-MD5";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

     /* client-mech.c --- Example SASL client, with a choice of mechanism to use.
      * Copyright (C) 2004, 2005  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * GNU SASL is free software; you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation; either version 2 of the License, or
      * (at your option) any later version.
      *
      * GNU SASL is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with GNU SASL; if not, write to the Free Software
      * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
     	buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static const char *
     client_mechanism (Gsasl * ctx)
     {
       static char mech[GSASL_MAX_MECHANISM_SIZE + 1] = "";
       char mechlist[BUFSIZ] = "";
       const char *suggestion;
     
       printf ("Enter list of mechanism that server support, separate by SPC:\n");
       fgets (mechlist, sizeof (mechlist) - 1, stdin);
     
       suggestion = gsasl_client_suggest_mechanism (ctx, mechlist);
       if (suggestion)
         printf ("Library suggest use of `%s'.\n", suggestion);
     
       printf ("Enter mechanism to use:\n");
       fgets (mech, sizeof (mech) - 1, stdin);
       mech[strlen (mech) - 1] = '\0';
     
       return mech;
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech;
       int rc;
     
       /* Find out which mechanism to use. */
       mech = client_mechanism (ctx);
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

     /* client-callback.c --- Example SASL client, with callback for user info.
      * Copyright (C) 2004, 2005  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * GNU SASL is free software; you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation; either version 2 of the License, or
      * (at your option) any later version.
      *
      * GNU SASL is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with GNU SASL; if not, write to the Free Software
      * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
     	buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech = "SECURID";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     static int
     callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop)
     {
       char buf[BUFSIZ] = "";
       int rc = GSASL_NO_CALLBACK;
     
       /* Get user info from user. */
     
       printf ("Callback invoked, for property %d.\n", prop);
     
       switch (prop)
         {
         case GSASL_PASSCODE:
           printf ("Enter passcode:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_PASSCODE, buf);
           rc = GSASL_OK;
           break;
     
         case GSASL_AUTHID:
           printf ("Enter username:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_AUTHID, buf);
           rc = GSASL_OK;
           break;
     
         default:
           printf ("Unknown property!  Don't worry.\n");
           break;
         }
     
       return rc;
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Set the callback handler for the library. */
       gsasl_callback_set (ctx, callback);
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

  -c, --client               Act as client (the default).
      --client-mechanisms    Write name of supported client mechanisms
                             separated by space to stdout.
  -s, --server               Act as server.
      --server-mechanisms    Write name of supported server mechanisms
                             separated by space to stdout.

      --connect=HOSTNAME[:SERVICE]
                             Connect to TCP server and negotiate on stream
                             instead of stdin/stdout. SERVICE is the protocol
                             service, or an integer denoting the port, and
                             defaults to 143 (imap) if not specified. Also sets
                             the --hostname default.

  -d, --application-data     After authentication, read data from stdin and run
                             it through the mechanism's security layer and
                             print it base64 encoded to stdout. The default is
                             to terminate after authentication.
      --imap                 Use a IMAP-like logon procedure (client only).
                             Also sets the --service default to "imap".
  -m, --mechanism=STRING     Mechanism to use.
      --no-client-first      Disallow client to send data first (client only).

  -n, --anonymous-token=STRING    Token for anonymous authentication, usually
                                  mail address (ANONYMOUS only).
  -a, --authentication-id=STRING  Identity of credential owner.
  -z, --authorization-id=STRING   Identity to request service for.
      --disable-cleartext-validate
                             Disable cleartext validate hook, forcing server to
                             prompt for password.
      --enable-cram-md5-validate  Validate CRAM-MD5 challenge and response
                                  interactively.
      --hostname=STRING      Set the name of the server with the requested
                             service.
  -p, --password=STRING      Password for authentication (insecure for
                             non-testing purposes).
      --passcode=NUMBER      Passcode for authentication (SECURID only).
      --quality-of-protection=<auth | auth-int | auth-conf>
                             How application payload will be protected.  "auth"
                             means no protection, "auth-int" means integrity
                             protection, "auth-conf" means integrity and
                             confidentialiy protection.  Currently only used by
                             DIGEST-MD5, where the default is "auth-conf".
  -r, --realm=STRING         Realm. Defaults to hostname.
      --service=STRING       Set the requested service name (should be a
                             registered GSSAPI host based service name).
      --service-name=STRING  Set the generic server name in case of a
                             replicated server (DIGEST-MD5 only).
  -x, --maxbuf=NUMBER        Indicate maximum buffer size (DIGEST-MD5 only).

      --starttls                Force use of STARTTLS.  The default is to use
                                  STARTTLS when available.  (default=off)
      --no-starttls             Unconditionally disable STARTTLS.
                                  (default=off)
      --x509-ca-file=FILE       File containing one or more X.509 Certificate
                                  Authorities certificates in PEM format, used
                                  to verify the certificate received from the
                                  server.  If not specified, no verification of
                                  the remote server certificate will be done.
      --x509-cert-file=FILE     File containing client X.509 certificate in PEM
                                  format.  Used together with --x509-key-file
                                  to specify the certificate/key pair.
      --x509-key-file=FILE      Private key for the client X.509 certificate in
                                  PEM format.  Used together with
                                  --x509-key-file to specify the
                                  certificate/key pair.

  -q, --quiet, --silent      Don't produce any diagnostic output.
  -v, --verbose              Produce verbose output.

  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

          int
          callback_gssapi (Gsasl_session_ctx *ctx,
          		 char *clientname,
          		 char *authentication_id)
          {
            int rc = GSASL_AUTHENTICATION_ERROR;
          
            krb5_principal p;
            krb5_context kcontext;
          
            krb5_init_context (&kcontext);
          
            if (krb5_parse_name (kcontext, clientname, &p) != 0)
              return -1;
            if (krb5_kuserok (kcontext, p, authentication_id))
              rc = GSASL_OK;
            krb5_free_principal (kcontext, p);
          
            return rc;
          }
     
     Copyright © 2000,2001,2002 Free Software Foundation, Inc.
     51 Franklin St, Fifth Floor, Boston, MA  02110-1301, USA
     
     Everyone is permitted to copy and distribute verbatim copies
     of this license document, but changing it is not allowed.

       Copyright (C)  year  your name.
       Permission is granted to copy, distribute and/or modify this document
       under the terms of the GNU Free Documentation License, Version 1.2
       or any later version published by the Free Software Foundation;
       with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
       Texts.  A copy of the license is included in the section entitled ``GNU
       Free Documentation License''.

         with the Invariant Sections being list their titles, with
         the Front-Cover Texts being list, and with the Back-Cover Texts
         being list.

GNU Simple Authentication and Security Layer 0.2.12

Table of Contents

GNU Simple Authentication and Security Layer

1 Introduction

1.1 Getting Started

1.2 Features

1.3 SASL Overview

1.4 Supported Platforms

1.5 Getting help

1.6 Commercial Support

1.7 Downloading and Installing

1.8 Bug Reports

1.9 Contributing

2 Preparation

2.1 Header

2.2 Initialization

2.3 Version Check

2.4 Building the source

2.5 Autoconf tests

2.5.1 Autoconf test via ‘pkg-config’

2.5.2 Standalone Autoconf test using Libtool

3 Using the Library

3.1 Choosing a mechanism

3.2 Using a callback

4 Properties

5 Mechanisms

5.1 The EXTERNAL mechanism

5.2 The ANONYMOUS mechanism

5.3 The PLAIN mechanism

5.4 The LOGIN mechanism

5.5 The CRAM-MD5 mechanism

5.6 The DIGEST-MD5 mechanism

5.7 The NTLM mechanism

5.8 The SECURID mechanism

5.9 The GSSAPI mechanism

5.10 The KERBEROS_V5 mechanism

6 Global Functions

7 Callback Functions

8 Property Functions

9 Session Functions

10 Utilities

11 Error Handling

11.1 Error values

11.2 Error strings

12 Examples

12.1 Example 1

12.2 Example 2

12.3 Example 3

12.4 Example 4

13 Acknowledgements

14 Invoking gsasl

Name

Description

Commands

Network Options

Miscellaneous Options:

SASL Mechanism Options

STARTTLS options

Other Options

Appendix A Protocol Clarifications

A.1 Use of SASLprep in CRAM-MD5

A.2 Use of SASLprep in LOGIN

Appendix B Old Functions

B.1 Obsolete callback function prototypes

Appendix C Copying This Manual

C.1 GNU Free Documentation License

C.1.1 ADDENDUM: How to use this License for your documents

Concept Index

Function and Data Index

Footnotes

2.5.1 Autoconf test via ‘`pkg-config`’